[FFmpeg-devel] [PATCH] avformat/mxfdec: Check that edit_unit_byte_count is not negative

[Tomas Härdin]

mån 2024-04-01 klockan 18:22 +0200 skrev Marton Balint:
> 
> 
> On Mon, 1 Apr 2024, Michael Niedermayer wrote:
> 
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> > libavformat/mxfdec.c | 6 +++++-
> > 1 file changed, 5 insertions(+), 1 deletion(-)
> > 
> > diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> > index e484db052ef..37446963369 100644
> > --- a/libavformat/mxfdec.c
> > +++ b/libavformat/mxfdec.c
> > @@ -1245,9 +1245,13 @@ static int
> > mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment
> > *seg
> > static int mxf_read_index_table_segment(void *arg, AVIOContext *pb,
> > int tag, int size, UID uid, int64_t klv_offset)
> > {
> >     MXFIndexTableSegment *segment = arg;
> > +    int tmp;
> >     switch(tag) {
> >     case 0x3F05:
> > -        segment->edit_unit_byte_count = avio_rb32(pb);
> 
> Why not simply make segment->edit_unit_byte_count unsigned?

This might run afoul with various calcultions. Speaking of,
mxf_edit_unit_absolute_offset() does not check for multiplication
overflows..

/Tomas